Subject: [Netconf] Configured Subscription: two receivers with different permissions

From: "Eric Voit (evoit)" <[email-masked]>
Date: Mon, 3 Apr 2017 16:37:05 +0000

During the IETF98 WG session, I mentioned a few issues to work through on the mailing list.

The first is the proper behavior of a configured subscription when there are 2+ receivers configured.  Here for management simplification reasons, we have been assuming the same subscription-id will be established for all receivers of the same configured subscription.   And that notifications will be sent tagged with the subscription-id.

However there might be different access control permissions associated with the different receivers (either intentionally or unintentionally). Therefore the security filtering process of information to each receiver might differ, and as a result different push updates could potentially be sent to each receiver.

Several approaches on this are:

(1) Filter each receiver's updates individually.  In this case the streams notifications might vary.  And if something downstream compares the different received information, they could see deltas.

(2) If there are different access permissions for different receivers, suspend the subscriptions until they are brought back into parity.  This will guarantee that equivalent notifications are sent, or not sent.

(3) Make a different subscription for each receiver so that there is no expectation of comparability in the resulting streams of updates.

I believe (1) is superior for the following reasons:
a: Method (2) opens an attack vector where you could hijack one of the receivers IP addresses and pull down the full solution.
b: Also with (2) if someone changes the access permissions in the middle of a subscription (via simple misconfiguration or rolling permissions upgrade) on one of the receivers, it could pull down the full solution.
c: It should not be up to the Publisher to police the permissions of different receivers.  If receivers choose to compare information, the publisher shouldn't care
d: For (3) forcing different subscription IDs doesn't solve anything technically, and it make management and administration harder as there will be replicated managed objects.

Any objections if we go with approach (1)?

Eric

---

From: "Eric Voit (evoit)" <[email-masked]>
Date: Mon, 10 Apr 2017 17:32:47 +0000

Based on silence, let's go with then (1)....    If a configured yang-push subscription has multiple receivers, each could get different update notifications if they have different access permissions.

Eric

From: Netconf [mailto:[email-masked]] On Behalf Of Eric Voit (evoit)
Sent: Monday, April 3, 2017 12:37 PM
To: [email-masked]
Subject: [Netconf] Configured Subscription: two receivers with different permissions

Eric